SCS-C02 Practice Test 28 — 15 Questions

Question 1

A security engineer is configuring a multi-account CloudTrail setup. The above bucket policy is attached to the central logging bucket. Despite the policy, CloudTrail in the member account (123456789012) cannot deliver logs. What is the MOST likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The condition s3:x-amz-acl is not required; CloudTrail does not set that ACL.. CloudTrail does not set the s3:x-amz-acl condition key when delivering log files to S3. The bucket policy incorrectly includes this condition, which causes the S3 authorization to fail because the condition key is not present in the CloudTrail PutObject request. Removing the condition or adjusting the policy to not require it resolves the delivery failure.

Answer

The Principal should be the CloudTrail service principal of the member account.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN must include the source account ID in the path.

Question 2

An application running on EC2 instances needs to access an S3 bucket. The Security Engineer wants to ensure that the EC2 instances do not have access keys and that the access is restricted to only the required bucket. What is the most secure way to provide this access?

Accepted Answer

Create an IAM role with a policy that allows access to the specific S3 bucket, and attach the role to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the instance to obtain temporary security credentials from AWS STS (Security Token Service) without storing any long-term access keys. The role's policy can be scoped to grant access only to the specific S3 bucket, ensuring least privilege. This approach eliminates the risk of key exposure and is the AWS-recommended best practice for granting EC2 instances access to AWS services.

Answer

Generate an access key for an IAM user with permissions to the S3 bucket and store it in the EC2 instance.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address to access the bucket.

Answer

Use the root user's access keys to configure the application.

Question 3

A security engineer is investigating a potential data breach. AWS CloudTrail logs show that an IAM user 'svc-backup' created an S3 bucket in the us-east-1 region and then uploaded a large number of objects. The engineer suspects that the user's credentials were compromised. What is the MOST efficient way to quickly identify the source IP address and user agent of the API calls made by this user?

Accepted Answer

Query AWS CloudTrail logs in Amazon Athena for the user's API calls.. CloudTrail logs capture detailed records of all API calls, including the source IP address and user agent for each request. By querying these logs with Amazon Athena, the security engineer can efficiently filter for the specific IAM user 'svc-backup' and extract the source IP and user agent from the relevant event records, enabling rapid identification of the compromised credentials' origin.

Answer

Analyze VPC Flow Logs for traffic to the S3 bucket.

Answer

Enable Amazon GuardDuty and review the generated findings.

Answer

Use AWS Config to review the configuration history of the S3 bucket.

Question 4

A security engineer attaches the above SCP to an OU containing development accounts. The engineer expects that only t3.micro instances can be launched, but developers report that they cannot launch any EC2 instances. What is the MOST likely reason?

Accepted Answer

The SCP denies all ec2 actions because there is no explicit allow statement.. SCPs operate on a default-deny model: all actions are implicitly denied unless explicitly allowed. The policy only denies non-t3.micro instance types but does not include an explicit Allow statement for ec2:RunInstances or any other EC2 action. Without an explicit Allow, the implicit deny blocks all EC2 actions, including launching t3.micro instances.

Answer

The SCP syntax is invalid because it uses Deny without an explicit Allow.

Answer

The condition StringNotEquals is evaluated incorrectly for EC2 instance types.

Answer

The SCP is applied at the organization root and overrides the OU-level policy.

Question 5

A security engineer needs to grant cross-account read access to an S3 bucket in Account A to a user in Account B. What is the correct combination of actions?

Accepted Answer

Apply a bucket policy in Account A granting access to the principal in Account B, and attach an IAM policy to the user in Account B allowing the action. Cross-account S3 access requires both a bucket policy in the resource account (Account A) that explicitly grants the cross-account principal (the user in Account B) the s3:GetObject action, and an IAM policy attached to the user in Account B that allows the same action. This two-way authorization is necessary because the bucket policy controls access to the S3 resource, while the IAM policy controls the user's permissions to initiate the request. Without both, the request will be denied by either the resource-based policy or the identity-based policy.

Answer

Attach an IAM policy to the user in Account B allowing the action; no bucket policy needed

Answer

Apply a bucket policy in Account A granting access to the user in Account B; no user policy needed

Answer

Use S3 bucket ACLs to grant READ access to the Account B user

Question 6

A security team discovers that an IAM user's credentials are being used from an unusual geographic location. Which AWS service can provide automated response to revoke the user's access immediately?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is correct because it can be triggered by Amazon GuardDuty findings (e.g., UnauthorizedAccess:IAMUser/AnomalousBehavior) via Amazon EventBridge to run an automation document that immediately revokes the IAM user's access keys and applies a deny-all policy. This provides a fully automated, low-latency response without requiring manual intervention or custom code.

Answer

Amazon GuardDuty

Answer

AWS Lambda

Answer

AWS Config

Question 7

A Security Engineer is troubleshooting why AWS CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail access. What is a likely cause of the issue?

Accepted Answer

The S3 bucket uses SSE-KMS and the key policy does not grant CloudTrail permission. When an S3 bucket uses SSE-KMS (Server-Side Encryption with AWS KMS), CloudTrail must have explicit permissions in the KMS key policy to decrypt the key and encrypt log files. Even if the S3 bucket policy grants CloudTrail access, the KMS key policy is a separate authorization layer; without a statement allowing CloudTrail to use the kms:GenerateDataKey and kms:Decrypt actions, log delivery will fail silently or with access denied errors.

Answer

The S3 bucket has a lifecycle policy that deletes objects too quickly

Answer

CloudTrail is not enabled in the region

Answer

The S3 bucket is in a different region than the trail

Question 8

A company runs a web application on EC2 instances in an Auto Scaling group across two Availability Zones. The instances are behind an Application Load Balancer. The security team wants to ensure that only the ALB can send traffic to the instances. The instances are in a security group named 'app-sg'. Currently, 'app-sg' has an inbound rule allowing HTTP traffic from 0.0.0.0/0. The team wants to restrict access to only the ALB's security group. The ALB is in a security group named 'alb-sg'. Which course of action should the security engineer take to meet the requirement with minimal disruption?

Accepted Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from security group 'alb-sg'.. Security groups can reference each other by ID, allowing traffic from any instance associated with the source security group (alb-sg) without needing to know the ALB's IP addresses. This ensures that only the ALB can send HTTP traffic to the EC2 instances, as the rule dynamically applies to all ALB nodes across Availability Zones. It also minimizes disruption because no IP changes are required, and the rule automatically scales with the ALB.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the private IP addresses of the ALB nodes.

Answer

Modify the inbound rule of 'app-sg' to allow HTTPS traffic from 0.0.0.0/0 and remove the HTTP rule.

Answer

Modify the inbound rule of 'app-sg' to allow HTTP traffic from the ALB's elastic network interface (ENI).

Question 9

A company uses Amazon GuardDuty and AWS Security Hub. The security team wants to automatically remediate high-severity GuardDuty findings that indicate an EC2 instance is communicating with a known command and control (C&C) server. The remediation should isolate the instance by modifying the security group to deny all inbound and outbound traffic. Which solution is the most efficient?

Accepted Answer

Send Security Hub findings to Amazon EventBridge, which triggers a Lambda function to modify the security group.. It leverages Security Hub as a central aggregation point for GuardDuty findings, then uses EventBridge to trigger a Lambda function that modifies the security group. This is the most efficient architecture as Security Hub normalizes findings from multiple sources, and EventBridge provides reliable, low-latency event routing to Lambda for custom remediation logic without requiring direct GuardDuty-to-security-group integration.

Answer

Use Amazon CloudWatch Events to directly modify the security group when a GuardDuty finding is published.

Answer

Configure GuardDuty to automatically update the security group when a finding is generated.

Answer

Create an AWS Config rule that triggers a Lambda function when a security group change is detected.

Question 10

A company is using AWS WAF to protect a web application behind an Application Load Balancer. The Security Engineer wants to block requests that contain SQL injection attacks. Which action should the Engineer take?

Accepted Answer

Create a WAF rule with a SQL injection match condition and set the action to block.. AWS WAF is the native service for filtering web traffic to Application Load Balancers, and it includes a managed rule set specifically for SQL injection (SQLi) detection. By creating a custom WAF rule with a SQL injection match condition and setting the action to 'Block', the Engineer directly instructs WAF to inspect incoming requests for SQLi patterns and drop matching traffic before it reaches the ALB. This is the correct, service-native approach for blocking SQL injection attacks at the application layer.

Answer

Enable AWS Shield Advanced to automatically block SQL injection attacks.

Answer

Use Amazon GuardDuty to detect and block SQL injection attempts.

Answer

Configure the security group of the EC2 instances to block traffic containing SQL injection patterns.

Question 11

A security engineer is investigating a potential security incident. Which TWO AWS services can be used to analyze historical network traffic patterns? (Choose TWO.)

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet/byte counts) for network interfaces in a VPC. They are stored in Amazon CloudWatch Logs or Amazon S3, enabling historical analysis of network traffic patterns. Athena can query VPC Flow Logs stored in S3 using SQL, making it a powerful tool for analyzing historical traffic patterns at scale.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 12

A company needs to grant cross-account access to an S3 bucket in Account A to users in Account B. What is the recommended approach?

Accepted Answer

Add a bucket policy in Account A that grants access to the IAM user ARNs from Account B.. A bucket policy in Account A can explicitly grant cross-account access to IAM user ARNs from Account B. This is the recommended approach for granting access to an S3 bucket across AWS accounts, as it avoids managing additional IAM users or roles and leverages the resource-based policy directly on the bucket. The bucket policy must specify the `Principal` element with the AWS account ID of Account B and the `Action` and `Resource` for the S3 operations, allowing Account B's IAM users to access the bucket after they have appropriate permissions in their own account.

Answer

Attach an IAM role to Account B's users.

Answer

Make the bucket public.

Answer

Create an IAM user in Account A and share the credentials with Account B users.

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to centrally aggregate and analyze VPC Flow Logs from all accounts. Which solution is MOST efficient and scalable?

Accepted Answer

Configure VPC Flow Logs to send to Amazon Kinesis Data Firehose in each account, which delivers to a central Amazon OpenSearch Service domain.. Amazon Kinesis Data Firehose can directly receive VPC Flow Logs from each account and deliver them to a centralized Amazon OpenSearch Service domain, enabling near-real-time aggregation and analysis without intermediate storage or replication overhead. This architecture is serverless, scales automatically, and avoids the complexity of managing cross-account S3 replication or EC2 instances, making it the most efficient and scalable solution for centralized log analysis.

Answer

Configure VPC Flow Logs to send to an S3 bucket in each account and use S3 Cross-Region Replication to a central bucket.

Answer

Launch Amazon EC2 instances in each account to run tcpdump and send logs to a central S3 bucket.

Answer

Configure VPC Flow Logs to send to CloudWatch Logs in each account and use cross-account CloudWatch dashboards.

Question 14

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Accepted Answer

Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.. Security groups are stateful, so allowing outbound traffic on port 3306 from the web servers to the database security group automatically permits the corresponding return traffic. This adheres to the principle of least privilege by specifying the destination as the database security group ID rather than a broad CIDR range, ensuring only the intended web servers can initiate the connection.

Answer

Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.

Answer

Place the database servers in a public subnet for easier connectivity.

Answer

Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.

Question 15

A security engineer is investigating a potential data exfiltration incident where an EC2 instance is sending large volumes of data to an unknown IP address. Which AWS service should the engineer use to capture and analyze the network traffic for evidence?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring is the correct choice because it allows you to capture and inspect network traffic from an EC2 instance by mirroring the traffic to a monitoring appliance or a security tool. This enables deep packet inspection to analyze the contents of the data being sent to the unknown IP address, providing evidence for data exfiltration. Unlike other services, Traffic Mirroring operates at the network level, copying all packets (including payloads) without affecting the source instance.

Answer

AWS WAF

Answer

AWS Shield

Answer

Amazon Inspector